gnutls-3.6.16-8.el8_10.4.ML.1
エラータID: AXSA:2025-10938:05
リリース日:
2025/10/10 Friday - 14:26
題名:
gnutls-3.6.16-8.el8_10.4.ML.1
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- GnuTLS には、メモリ領域の二重解放の問題があるため、リモート
の攻撃者により、サービス拒否攻撃、およびメモリ破壊を可能とする
脆弱性が存在します。(CVE-2025-32988)
- GnuTLS の certtool 内のテンプレート解析ロジックには、ヒープ
ベースのバッファオーバーフローの問題があるため、リモートの攻撃者
により、メモリ破壊、およびサービス拒否攻撃を可能とする脆弱性が
存在します。(CVE-2025-32990)
- GnuTLS には、NULL ポインタデリファレンスの問題があるため、
リモートの攻撃者により、データ破壊、およびサービス拒否攻撃を
可能とする脆弱性が存在します。(CVE-2025-6395)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-32988
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
CVE-2025-32990
A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.
A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.
CVE-2025-6395
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
追加情報:
N/A
ダウンロード:
SRPMS
- gnutls-3.6.16-8.el8_10.4.ML.1.src.rpm
MD5: 865ac96aea214eeeaf4e3e5e9cf14a50
SHA-256: 4f151168b87aa60ca86c09b87c8560f025c087c1aab42fb6e4820b1d2b5a56df
Size: 5.52 MB
Asianux Server 8 for x86_64
- gnutls-3.6.16-8.el8_10.4.ML.1.i686.rpm
MD5: 360d64d3c71c55e5ed917bd3c3da1f9b
SHA-256: fb36c92618650f799d42356047d52792d59f9448fa0c83550195a7d718315297
Size: 1.01 MB - gnutls-3.6.16-8.el8_10.4.ML.1.x86_64.rpm
MD5: 3062fbb9ce350a386bf0f043ae587c3d
SHA-256: 5bc44fae8945c471448c809eba2bd0e5712d61139f754e7712dd2399c3b8f567
Size: 0.99 MB - gnutls-c++-3.6.16-8.el8_10.4.ML.1.i686.rpm
MD5: f62705edba76c0961655fa173f0a9a2f
SHA-256: 7631ef5d26346a2040a7813c0fcfbda0870dc2a4f0f40698b3b76a5fbd2d577e
Size: 49.85 kB - gnutls-c++-3.6.16-8.el8_10.4.ML.1.x86_64.rpm
MD5: c837ddfdffba30b791336d5677bc8701
SHA-256: 252cef8e44a5e5bc14b6ba6665a581421372aef74a317f6363d6278acb82e3c1
Size: 48.79 kB - gnutls-dane-3.6.16-8.el8_10.4.ML.1.i686.rpm
MD5: 378181100221921a8958070d47ae44aa
SHA-256: c2aa181a8f9d421b83029ce3e6eb505500927a713262da76a2dbc20a67a9ab50
Size: 53.08 kB - gnutls-dane-3.6.16-8.el8_10.4.ML.1.x86_64.rpm
MD5: b2697826af9a3d4f7724b3546bf8e306
SHA-256: 137d83f16bfc7da727a20c5cb373b65959369e15501d1be82effc47dcd24cf03
Size: 52.18 kB - gnutls-devel-3.6.16-8.el8_10.4.ML.1.i686.rpm
MD5: 452a890eafbb200d0ce48075dd6d7496
SHA-256: 9149ec5b2a71555ab2f1c94541b4c972b8ee35a535e833d71862a63d2b07f55d
Size: 2.18 MB - gnutls-devel-3.6.16-8.el8_10.4.ML.1.x86_64.rpm
MD5: 49b3b356be3a204df89baa38f2e6bbb4
SHA-256: 97765a64fdc1ec0f2d96447e72645a278636a1b16b14302dd18326f5fd665fe6
Size: 2.18 MB - gnutls-utils-3.6.16-8.el8_10.4.ML.1.x86_64.rpm
MD5: a9cdb8501667ae604b153c1622cce36a
SHA-256: 3bc9ac96da89925b43247ba769444a62aa127fcab5c797f7140eb861d273bc0d
Size: 348.85 kB
English